Noise Sensitivity-Based Energy Efficient and Robust Adversary Detection in Neural Networks

Adversarial Detection without Model Information

“…These works show that adversarial and natural inputs can be distinguished based on the intermediate features of the target model. Metzen et al [22] and Sterneck et al [25] use the intermediate features to train a simple binary classifier for adversarial detection. While Metzen et al [22] use a heuristic-based method to determine the point of attachment of the detector with the target model, Sterneck et al [25] use a structured metric called adversarial noise sensitivity to do the same.…”

“…Metzen et al [22] and Sterneck et al [25] use the intermediate features to train a simple binary classifier for adversarial detection. While Metzen et al [22] use a heuristic-based method to determine the point of attachment of the detector with the target model, Sterneck et al [25] use a structured metric called adversarial noise sensitivity to do the same. Similarly, Yin et al [30] use asymmetric adversarial training to train detectors on the intermediate features of the target model for adversarial detection.…”

“…Table 6 compares the performance and cost-effectiveness of our proposed method with prior state-of-the-art adversarial detection works. Metzen et al [22], Yin et al [30], and Sterneck et al [25] train neural network-based detectors on the intermediate features of the target model for adversarial detection. On the other hand, Xu et al [29] and Moitra et al [23] train the target model for improving the adversarial detectability.…”

“…The striking feature of our approach is the energy-based separation and layer-wise training that generalizes well to both weak and strong adversarial attacks. Further, unlike [25], our approach is agnostic to white-box and black-box attacks. Computational overhead: Besides high adversarial detection, our method requires ∼ 10×−100× less number of operations and parameters for adversarial detection compared to works [11,22,25,29,30].…”

“…Further, unlike [25], our approach is agnostic to white-box and black-box attacks. Computational overhead: Besides high adversarial detection, our method requires ∼ 10×−100× less number of operations and parameters for adversarial detection compared to works [11,22,25,29,30]. Although we require more parameters compared to [23], the number of computations in our detection is significantly less.…”